CVE-2025-15663: BEAF < 4.7.19 - Author+ Stored XSS via After Label
The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's after-label value before its bundled client-side script re-injects it into the DOM, allowing users with the Author role and above to store a payload that executes in the browser of anyone (including an administrator) who views the slider.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
A user with the WordPress Author role or any higher-privileged role can store a malicious payload in a slider's after-label value.
Who is exposed to the stored payload?
Anyone who views the affected slider can have the payload execute in their browser, including WordPress administrators.
Are current BEAF releases affected?
The issue affects BEAF versions before 4.7.19. Updating to version 4.7.19 or later removes the affected version range described here.
What can be done if an update cannot be applied immediately?
Restrict untrusted users from holding the Author role or higher, and review existing slider after-label values for unexpected or unsafe content. Remove or recreate any suspicious labels before users or administrators view the associated sliders.